With more and more individuals connected to the Internet and having electronic mail (email) accounts, it has become feasible for advertisers and other groups or individuals to disseminate advertisements and promotions to a large audience. Many such advertisements and promotions are sent as unwanted email messages (spam) to large numbers of email users.
A common technique used by spammers is to spoof a domain name in an attempt to make an email message appear to be coming from one domain, when, in fact, it is being sent from a different domain. Because spammers frequently spoof domain names, email filters that are trained based on previously received email messages, may mistakenly determine that a particular domain is frequently associated with spam. For example, a particular domain (e.g., microsoft.com) may be associated with a company (e.g., Microsoft, Inc.) that does not send spam, but because the domain may be frequently spoofed by spammers, an email spam filter may be inaccurately trained to assume email from the microsoft.com domain is spam.
One attribute of an email message that is difficult to conceal or alter is an IP address from which the email was sent. While it is fairly easy for spammers to spoof a domain name, it is very difficult to spoof an IP address. Furthermore, email that is legitimately sent from a particular domain (e.g., microsoft.com) is typically sent from a computer having an IP address that is associated with the owner of the domain (e.g., Microsoft, Inc.). For example, Microsoft may be assigned a group of IP addresses each of which is associated with a computer belonging to Microsoft. When an email message is sent from one of those computers, the IP address of the sender matches one of the IP addresses that is assigned to Microsoft, Inc., and the domain is also owned by Microsoft, Inc. However, if a spammer sends an email message with a spoofed microsoft.com domain, the sender IP address associated with the email message will not be an IP address that is assigned to Microsoft.
Accordingly, a need exists for an email spam filtering technique that utilizes both an IP address and a domain associated with a received email message.